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[57] ABSTRACT 

An IC card having an authentication code which is 
compared with an authentication code obtained . by 
processing data recorded on the IC card, and permitting 
the IC card to be used only when agreement is found. 
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(i) The IC card administrator prepares in advance sets 

IC CARD of encipher keys and decipher keys for a number of the 

transaction areas that are to be kept secret, and prepares 

BACKGROUND OF THE INVENTION a master decipher key for all of the decipher keys. 

The present invention relates to electronic shopping, 5 69 ^ IC card administrator assigns an encipher key 

electronic check books, credit cards and the like, and °° dc and a deci Pker key code for each of the transac- 

particularly to an IC card which is adapted to prevent- tjon areas » writes available upper-limit amount of 
ing data alteration, forgery and the like among the trad- money and the encipher key code or the decipher key 

ere. code on a portion of the corresponding transaction area, 

The IC card which consists of a plastic card in which 10 md encrypts the transaction area using the encipher 
an IC (integrated circuit) is embedded has functions for 

identifying the individual person and for making forg- C 1 ") The IC card administrator hands the IC card 

ery difficult, and has a large memory capacity. Such a over t0 tne user - The IC card administrator further 

card finds application in electronic settlement, personal - hands the encipher keys and the decipher keys to the 

information files, security control and the like. respective individual stores so that they can encrypt and 

When a person goes shopping in supermarkets and decipher the transaction areas, 
department stores using an IC card, it is desirable from Owing to the above-mentioned procedures (i) to (iii), 
the standpoint of privacy that a list of purchases made in different encipher keys and decipher keys are held by 
one store not be readable in other stores in which the 20 tne d^ 6 ™ 1 * stores. Therefore, a given store is permit- 
person makes another purchase. For this purpose, the ted to process only the transaction areas that corre- 
IC card should be provided with transaction areas that spond to the encipher key and the decipher key held by 
are different depending upon the store, so that one store that stores from among the plurality of transaction areas 
is not allowed to make reference to the transactions of contained in the IC card. This makes it possible to pro- 
other stores. 25 tect the privacy of the user. The IC card administrator 

A first problem in the conventional art is that, there holds the master decipher key which is capable of deci- 

had been proposed neither a method of protecting a phering all of the transaction areas in the IC card, 

plurality of transaction areas in the same IC card by Therefore, the master decipher key can be used should 

different encipher keys nor a key control method suited the individual decipher keys be lost. Furthermore, the 

for this purpose. 30 master decipher key need not be used for the transac- 

Among the public key cipher systems, on the other tions, and can be safely administered, 
hand, a master key exists in the RSA method and in the In order to achieve the above second object, further- 
Rabin method. Using the master key, the above-men- more, the data in the card are detected by checking the 
tioned key control can be effectively carried out. balance and by checking a data alteration detection 

A second problem in the conventional art is that 35 code to detect the alteration or forgery of data. Further, 
consideration has not been given in regard to forgery of data alteration or forgery in the store transaction file or 

the IC card, and alteration or forgery of data in the in the bank transaction file, is checked by collating the 

card data alteration detection code and the IC card data. 

A third problem is that the conventional IC card has A data alteration detection circuit in principle resem- 
been fabricated based on a prerequisite that it be used by 40 bles the algorithm of a code error detection circuit, and 
an individual person (see Nikkei Computer, "Will the can be implemented by using a crytograph apparatus 
Age of IC Card Come?", July 8, 1985), Health manage- and feeding the output thereof back to the input thereof, 
ment data, property management data and like data may To achieve the above third object, furthermore, a 
be input to the IC card to utilize them. In addition to the microprocessor for the IC card determines the permit- 
situation where the user himself keys in the personal 45 ted access relying upon the personal identification num- 
identifxeation number to obtain the desired data, how- ber (codes are also acceptable in addition to numerals) 
ever, it may often happen that a medical doctor or a that is input, and an accessible data region is determined 
bank employee keys in another personal identification to output the permitted data. 



number to take out all or part of the desired data, such 
as in an emergency. 50 



BRIEF DESCRIPTION OF THE DRAWINGS 



SUMMARY OF THE INVENTION 



FIGS. 1A and IB are block diagrams showing the 
structure of an IC card according to a first embodiment 

A first object of the present invention is to provide an of the present invention; 

IC card which is capable of protecting the data in differ- FIG. 2 is a flow chart of an operation when a user 

ent transaction areas in the IC card. 55 makes a purchase in a store using the IC card; 

A second object of the present invention is to provide FIG. 3 is a block diagram showing the structure of an 

an IC card which makes it possible to detect forgery of IC card according to a second embodiment of the pres- 

the card, or alteration or forgery of data in the card ent invention; 

such as a cashless shopping credit card. FIG. 4 is a block diagram showing the structure of 

A third object of the present invention is to provide 60 the data alteration detection circuit in the IC card; 

an IC card which permits the user of the card to take FIG. 5 is a block diagram showing the structure of an 

out the data and which also permits only a limited num- IC card according to a third embodiment of the present 

ber of persons to take out the data in case of an emer- invention in an IC card system for health management 

gency. data; 

In order to achieve the above first object, the present 65 FIG. 6 is a diagram illustrating the data structure in a 

invention carries out the below-mentioned processing in ROM; and 

writing data onto, or in reading data from, the transac- FIG. 7 is a diagram illustrating the data structure in 

tion areas of the IC card. an EEROM. 
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DETAILED DESCRIPTION OF THE then '. the k , e V memor y "3 is encrypted with the 

PREFERRED EMBODIMENTS ^ ^ P f .u ■ ■ , 

When it is found that the authentication codes are not 

FIGS. 1A and IB show the manner of structuring an in agreement, the IC card produces a signal to inform 
IC card and FIG. 2 shows the structure of the IC card, 5 the store 109 of this fact so that the store 109 may follow 
according to a first embodiment of the present inven- the necessary procedure to inhibit the purchase. 

Next, described below is an example of shopping 

First, preparation is carried out as described below. using an IC card according to a second embodiment of 

An IC card administrator 101 prepares sets (102, 103), the present invention. 
. . . , (106, 107) of encipher keys and decipher keys, 10 In this example of shopping, illegal acts may be done 
prepares a master key 108 for the decipher keys 103, . . by altering the data in the card, such as altering the data 
. , 107, and retains the master key 108 in a secure place. of cash receipts from a bank and altering the data of 
Thereafter, the IC card administrator 101 hands the sets sales and purchases. 

(102, 103) (106, 107) of encipher keys and decipher FIG. 3 is a block diagram of the IC card for prevent- 

keys over to the stores 109, . . . , 111. The IC card 15 ing this sort of illegal activity. 

adrninistrator, further, writes an available upper-limit The IC card process is not allowed to proceed to the 
amount of money onto the transaction areas 122, . . . , next operation unless the user of the IC card is con- 
124 of the IC card 125. The IC card adrninistrator then firmed by a collation circuit 1 relying upon a password 

encrypts the sets (102, 103) (106, 107) of encipher or the like. A security code 2 has been written on a 

keys and decipher keys with an encipher key code that 20 read-only memory which cannot be directly read from 
corresponds to each of the cards, and writes each of the the external side. An account number 3 has also been 
sets onto each of the key memories 113, . . . , 115 of the written in the read-only memory. A data alteration 
IC card 125, and then encrypts authentication codes detection circuit 4 forms an encrypted authentication 
corresponding to data written on each of the transaction code by feeding the output of a cryptograph apparatus 
areas with an encipher key code that corresponds to 25 back to the input side thereof as shown in FIG. 4. That 
each of the cards and writes them down. The IC card is, if the data 61, . . . , 64 to be authenticated are altered 
administrator then hands the IC card 125 over to a user and are input as data 6 of FIG. 4, effects of bits of the 
116 altered data are successively propagated forward, and a 

Here, the authentication code refers to data written code 65 is formed that is different from the original 
on the transaction areas, that are compressed. For in- 30 code. Therefore, the fact of alteration is detected, 
stance, use is made of a MAC (message authentication An input/output control circuit 5 is an interface cir- 
code) of U.S. ANSI Bank Association Message Authen- cuit between the IC card and the terminals 30, 31 for the 
tication Standards (FIMAS). card. A data file 6 is concerned with input times, termi- 

The data are written into a memory 119 and are read nal numbers, cash receipts and payments, balance, data 
out from the memory 119 by driving a processor 117 35 alteration detection code and the like, 
under the control of software 120 contained in a ROM First, to write the cash receipt onto the card, the card 
(read-only memory) 118 via an I/O part (input and is set to a banking terminal 30, and a password is input 
output part) 112. from the keyboard. The password is input through the 

FIG. 2 is a flow chart for processing the IC card input control circuit 5 and is collated with the code in 
when the user 116 makes a purchase in a store 109. 40 the circuit by the collation circuit 1, to make sure that 

201: The user inputs his personal identification num- the user is a person who is authorized to possess the 
ber into the processor 117 via I/O part. card. If the collated result is acceptable, the account 

202: The processor 117 draws the personal identifica- number is sent to the input/output control circuit 5 in 
tion number from a secret area 121 under the control of response to a signal from the collation circuit 1. An 
software 120. 45 account Rle is then opened at the banking terminal. As 

203: The processor 117 produces, via I/O part, a the cash receipt data is input to the card from the key- 
signal "OK" when the personal identification number board, a security code at the terminal is input to the card 
applied by the user 116 is in agreement with the per- together with the cash receipt, time, balance, and termi- 
sonal identification number contained in the secret area, nal number. In the card, the data that has passed 
and produces a signal "NO" when they are not in agree- 50 through the input control circuit is sent to the data 
ment ' alteration detection circuit 4 which obtains a data alter- 

204: When the signal "NO" is produced, the proces- ation detection code by giving the time, terminal num- 
sor 117 does not write data or does not read data until ber and cash receipt as inputs to the cryptograph appa- 
the signal "OK" is next produced. ratus with the security code of the card and security 

205: When the signal "OK" is produced, the store 109 55 code of the terminal as keys. These data are written into 
updates the contents of the transaction area 122, using file 6 and are, at the same time, written into the account 
the encipher key 102 and decipher key 103, depending file. The security code of the terminal is recorded on the 
upon the items which the user 116 has purchased. security code area 2 of the card. Here, the security code 

Updating of the contents of the transaction area will area is a memory region equipped with means to protect 
now be described. The code of decipher key 103 is 60 the data, using hardware and software manners so that 
applied to the IC card via I/O part 112 by the store 109, the data will not be available to an outsider or the data 
and the data in the key memory 113 is deciphered. may not be written by an outsider. 
Then, it is confirmed whether an authentication code To do shopping in a store, the card is connected to a 
contained in the deciphered data is in agreement with an shopping terminal 31, and a password is input through 
authentication code that is calculated from the data of 65 the keyboard at the shopping terminal 31. If a proper 
the transaction area 122. After they are confirmed to be password is applied, the shopping terminal reads the 
in agreement, the transaction area 122 and the authenti- balance from the card. After the balance is checked, 
cation code are updated depending upon the purchase therefore, prices of the purchased merchandise are 
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input through the keyboard at the terminal 31. As the Further, when the record is not in agreement, the 

cash payment, time, balance, shopping terminal number content thereof being the balance, proper or improper 

and security code at the terminal are input as described use is determined by checking each of the balances, 

earlier, the data alteration detection circuit 4 in the card It is also possible to use numbers such as serial num- 

receives time 61, terminal number 62, cash receipts and 5 bers instead of the time data. 

payment 63 and balance 64 as inputs to obtain a data According to the above-mentioned embodiment of 

alteration detection code 65 with the security codes of the present invention, it is possible to detect the alter- 

the card and terminal as keys, These data are written on at *o n of data in the IC card and in the bank file, 

the file 6 and are, at the same time, written on the store The IC card according to a third embodiment of the 

transaction file 32 together with the account number 10 present invention will now be described in conjunction 

recorded in the bank account number via the shopping FIGS. 5 to 7. 

terminal 31. FTO' 5 is a diagram which schematically illustrates 

The store transaction file 32 is transferred to the bank, structure of an IC card system for health manage- 

sorted by account numbers, and is written onto the ment wherein the IC card 100 is connected to a 

account file 33. 15 te™* 11 * 1 200 *° r toe IC card via an interface 290, to 

As the balance becomes small and the user writes ex 5? it ^ e functioris of ! ? card 

cash receipts onto the card again, the user sets the card ™ e , IC C0nsist f °U microprocessor 120, an 

to the banking terminal 30 and inputs the password. If ROM (read-only memory) 110, a PROM (programma- 

the password is acceptable, file of the card can be read We readonly memory) 130, and an EEPROM (etectri- 

out from the bankmgtenn^ 20 caUy erasable prograrnmable read-only memory) 140, 

reads the account number from the card and opens an are connected together via stgnal hnes 150. As 

account file in which have already been written the data * e IC M° is connected via a signal lme lW to the 

from the store. Therefore, permissible or imr*rmissible *?^ 2 ? 0 £ r 10 a P«*«« « the PROM 130 

use of the card is discrinulted by collating the file of ^ *^ ded m the ^processor 120 so that it can be 

the card with the account file and by checking the bal- ^ m for ^ JC card of a ^ 

^ff v 4 l j * *t. j j crocomputer 240, a keyboard 210 and a display 220, that 

If both records are correct, the records are erased m connected togethe y r through signal ^ m Thc 

trom tne card tue. microcomputer 240 is further connected to a data man- 

If the records are aU acceptable, the bank transfers 3Q m ^ m Wa a ^ ^ 18Q a ^ODEM 

the amount of money which the customer has spent to 31Q & blic ^ ephonQ ^ 320 md ^er MODEM 

the store. The balance is calculated in the bank. 330 The data ^g^ent centet m consists of a 

To check the balance, cash payments 63 due to each com puter 410 and a data base 420. 

purchase are subtracted from the initial balance of the A possessor 0 f the IC card 100 may visit a doctor 

card file, and the subtracted result is collated with the 35 who ^ not Ms familv physician, and properly inputs his 

balance 64. personal identification number through the keyboard 

When the records are not in agreement, the security 2 10. The signal is then sent to the microprocessor 120 in 

code at the terminal is read out for each of the records Ae IC cani via ^ microcomputer 240 on the side of 

from the bank file relying upon the terminal number 62 th e terminal 200. The microprocessor 120 searches 

of the records. The security code and the record are 40 through the ROM 110. 

then input to the card to obtain a data alteration detec- Here, the ROM 110 has a data structure as shown in 

tion code from the card. The collating of this code with piG. -ph at ^ me data structure consists of a personal 

the data alteration detection code of the previous re- identification number 111 of the possessor of the IC 

cord of the card or of the bank file is referred to as the card iqo, a permission level 112 of information refer- 

checking of detection code. 45 encc Q f the possessor, license codes 113 of the medical 

It is now presumed that a record is not in agreement, practice of the registered doctors, their personal identi- 

the content of the record that is not in agreement being fication numbers 114, their permission levels 115 of 

the time. In this case, the record of a time that is in information reference, authentication codes 117 of the 

agreement with any one of the records is found from the data of the registered doctors, and a permission level 

card file and the bank file. 50 116 of information reference for non-registered doctors. 

(a) The IC card contains no corresponding record, if the microprocessor 120 which searches through 
and the detection code check of the bank record and the the ROM 110 indicates that the personal identification 
balance check are correct. In this case, the card does number that is input is in agreement with thc personal 
not contain a record, and it is assumed that the record is identification number 111 of the possessor, the permis- 
erased from the IC card. 55 sion level 112 of information reference is read out It is 

(b) The IC card contains no corresponding record, presumed that there exists only one level 1. Based upon 
and the detection code checking of the bank record is this level, the microprocessor 120 reads the data file in 
not acceptable. In this case, the record was added on the the EEPROM 140. 

side of the bank, and it is considered that the record was FIG. 7 illustrates a data structure in the EEPROM 

unfairly added to the bank file. 60 140. Here, it is presumed that the data A (accessible 

The same determination can also be rendered even with level 1 and level 2) 141 and the data B (accessible 

when the record on the side of the bank contains no with level 1 only) 142 are contained in the EEROM 

corresponding record. 140. For instance, the data A 141 contains data neces- 

Next, when the record is not in agreement, the con- sary for the diagnosis and therapy, such as blood type, 

tent of the record that is not in agreement being the 65 diagnosis result of medical examination, medical his- 

terminal number and the cash receipts and payments, tory, and the like. The data B 142 contains such data as 

proper use or improper use is determined by checking family structure and the like, that have no direct rela- 

each of the detection codes. tion to the diagnosis or therapy, as well as those data 
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which the possessor of tjje card may not wish to have 
known to other persons without his permission. 

In this case, the level 1 is given by the microprocessor 
120 to make access to the data A 141 and the data B 142. 
The data are sent from the microprocessor 120 to the 5 
microcomputer 240 for terminal, 200 subjected to pro- 
cessing for display, and are displayed on the display unit 
220. The data are also displayed for the doctor to be 
utilized for the diagnosis and therapy. Part of the results 
is also input through the keyboard 210, and is written 10 
onto the data A 141 or the data B 142 in the EEPROM 
140 via microcomputer 240, microprocessor 120 and the 
like. 

Here, it may happen that the possessor of the IC card 
100 needs emergency therapy due to, for example, a IS 
traffic accident, the possessor not being able to input his 
personal identification number by himself. In this case, 
the doctor inputs the code of his license code of practice 
medicine and his personal identification number 
through the keyboard 210. The input results are sent to 20 
the microprocessor 120 in the IC card 100 via the mi- 
crocomputer 240. The microprocessor 120 prepares an 
authentication code with the personal identification 
number 114 as a key and with the file data of the regis- 
tered doctor as an input data, determines whether the 25 
thus prepared authentication code is in agreement with 
the authentication code 117 that is written in the file 
data, compares the license code 113 for the practice of 
medicine and the personal identification number 114 of 
the registered doctor in the ROM 110 with the license 30 
code for the practice medicine and the personal identifi- 
cation number that arc input. When they are in agree- 
ment, the microprocessor 120 reads the permission level 

115 of information reference and reads the data that 
meets the permission level from the EEPROM 140. The 35 
result is displayed on the display unit 220 via micro- 
processor 120 and microcomputer. 

When the license code for the practice of medicine is 
found on the corresponding ROM 110 but when the 
personal identification number is not in agreement, this 40 
fact is displayed on the display unit 220, and the pro- 
cessing is completed. 

When even the license code for the practice medicine 
is not found on the ROM 110, the license code for the 
practice of medicine and the personal identification 45 
number input by the doctor are sent to the data manage- 
ment center 400 where the computer 410 performs the 
collation with regard to whether the data base contains 
data that are in agreement with the license code for the 
practice of medicine and the personal identification 50 
number. If the two are in agreement, a secret code 
which indicates the agreement is sent to the IC card 100 
via microcomputer 240 and the like. The IC card 100 
takes out the data depending upon the permission level 

116 of information reference for non-registered doctors, 55 
and displays the data on the display unit 220. 

When the license code of for the practice of medicine 
or the personal identification number of the doctor that 
is input is not in agreement, this fact is displayed on the 
display unit 220, and the processing is completed. 60 

To avoid accidental agreement that might occur 
when the data are input many times, it is allowable to 
provide such a countenneasure that repeated access is 
not permitted in case an incorrect personal identifica- 
tion number is input more than M times (M is a prede- 65 
termined number). When access is made to the data 
management center, furthermore, it can be contrived to 
leave the license code for the practice of medicine, the 
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data and time, and the possessor of the card in the data 
base of the data management center as a data log. 

In the foregoing were described the cases where 
separate contents were stored in the ROM 110 and 
EEPROM 140. The contents, however, may be stored 
together in the EEPROM 140. Furthermore, a RAM 
(randam access memory) may be employed instead of 
the EEPROM provided the data are stored without 
being erased. 

The foregoing embodiments have dealt with the cases 
where there were two permission levels of information. 
However, it does not needs to be pointed out that there 
may be three or more permission levels of information. 

Further, though the above description has dealt with 
the IC card system for health management data, the 
invention can also be adapted to an IC card system for 
property management data and like systems where a 
third person who is qualified is allowed to make access 
to the data in an emergency case. 

The following advantages are obtained from the sys- 
tem of the present invention in which a banking organ 
plays the role of an IC card administrator and issues an 
IC card for a user so that he is allowed to utilize a plu- 
rality of stores. 

(1) Protection of privacy; Data such as the name of 
merchandise and the amount of money are encrypted 
with encipher key codes that are different for each of 
the stores, and are written onto the IC card. Therefore, 
the situation in which the card is used in one store is 
kept secret for other stores, and privacy of the user is 
protected. 

(2) Easiness of key administration: The IC card ad- 
ministrator, who has a master decipher key for a user, is 
allowed to decipher all data contained in the IC card. 
The IC card administrator requires less labor for key 
administration in settling the amounts of money spent as 
recorded in the IC card. 

(3) Safety of key administration: The master decipher 
key is administered by the IC card administrator only^ 
and the number of times access is required is relatively 
small. Therefore, the master decipher key can be safely 
administered. Further, in case the store has accidentally 
lost the encipher key or the decipher key, the encipher 
key code or the decipher key code in the IC card can be 
easily taken out using the master decipher key. 

(4) It is possible to detect alteration or forgery of data 
in the IC card and in the bank file. 

(5) In an emergency case, a third person who is quali- 
fied is allowed to make access to the data and use the 
data, on behalf of the possessor of the IC card. 

(6) The level of data for making access is permitted 
can be divided, so that the data are taken out within a 
range of a given level Therefore, the data which the 
possessor of the card does not wish to let other persons 
know can be kept secret from third persons. 

(7) A third person who is qualified classfies the data 
into those registered to the card and those registered to 
the adrninistration center, so that when a medical doc- 
tor uses the data, the labor and cost can be reduced for 
making access to the center through a communication 
circuit. 

What is claimed is: 

1. In an integrated circuit card having a memory with 
a plurality of transaction memory areas, each adapted 
for storing data related to an associated data source, and 
a like plurality of authorization memory areas, one au- 
thorization memory area uniquely associated with each 
transaction memory area; input/output means for re- 
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ceiving data from and transmitting data to a data source; 
and processor means for exchanging data with said 
input/output means and with said memory and for pro- 
cessing data; the improvement wherein said processor 
means includes: 5 

input means for receiving data from a data source; 

acquiring means responsive to input from the data 
source of an enabling code unique to that data 
source for acquiring an encrypted code from the 
one of said authorization memory areas associated to 
with the transaction memory area that is associated 
with that data source; 

means for calculating an authorization code from 
data stored in said associated transaction memory 
area; 15 

means for comparing the acquired encrypted code 
with the calculated authorization code; 

means responsive to a proper comparison for permit- 
ting receipt of transaction data from the data 
source; and 20 

means responsive to receipt of transaction data from 
the data source for writing of transaction data into 
said associated transaction memory area to update 
data stored therein and for updating the encrypted 
code in said authorization memory area* 25 

thereby preventing access to said associated transac- 
tion memory area if the data therein has been al- 
tered without authorization. 

2. The improvement of claim 1 wherein said proces- 
sor means further includes means responsive to receipt 30 
of a master enabling code and receipt of a signal indicat- 
ing a selected transaction memory area for permitting 
processing of data from and writing of data into said 
selected transaction memory area, thereby permitting 
access to the selected transaction memory area, 35 

3. An integrated circuit card comprising: 
input/output means; 

a memory having a plurality of memory areas, each 
memory area adapted for storing data and having 
assigned thereto a permission level; 40 

first means defining a personal identification code 
storage area for storing personal identification 
codes; 

second means defining a license code storage area for 
storing license codes; 45 



third means defining a permission code storage area 
for storing permission codes, each permission code 
indicating a permission level for access to data 
stored in said memory; and 

fourth means responsive to application to said input- 
/output means of a license code and a personal 
identification code for interrogating said storage 
areas, comparing the applied license code with 
stored license codes, comparing the applied per- 
sonal identification code with stored personal iden- 
tification codes, and when proper comparisons are 
found, obtaining from said third means a permis- 
sion code and making available to said input/out- 
put means, for application to an external device, 
data stored in said memory having an assigned 
permission level not greater than the permission 
level indicated by the obtained permission code. 

4. In an integrated circuit card having a memory with 
a transaction memory area, for storing data from a data 
source, and an authorization memory area; input/out- 
put means for receiving data from and transmitting data 
to a data source; and processor means for exchanging 
data with said input/output means and with said mem- 
ory and for processing data; the improvement wherein 
said processor means includes: 

input means for receiving data from a data source; 

means responsive to input of an enabling code from 
the data source for acquiring an encrypted code 
from said authorization memory area; 

means for calculating an authorization code from 
data stored in said transaction memory area; 

means for comparing the acquired encrypted code 
with the calculated authorization code; 

means responsive to a proper comparison for permit- 
ting receipt of transaction data from the data 
source; and 

means responsive to receipt of transaction data from 
the data source for writing of transaction data into 
said transaction memory area to update data stored 
therein and for updating the encrypted code in said 
authorization memory area, 

thereby preventing access to said transaction memory 
area if the data therein has been altered without 
authorization. 
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